Trending OSS — embedded, mobile, networks, web, AI · 2026-10-20 09:01

Trending OSS — embedded, mobile, networks, web, AI

React Native 0.88 ships web-based event dispatching and SceneDelegate with no breaking changes — Meta’s Oct 19 release makes W3C EventTarget dispatch the default, adds fontVariationSettings on Text/TextInput, iOS UIScene lifecycle support for the iOS 27 SDK, React 19.3.0, and Metro 0.87. It is the third consecutive RN release with no user-facing breaking changes; Expo SDK 58 will pick it up. reactnative.dev · cmvga0sowac00dc4bc023f72e

vLLM 0.32.0 expands structured decisions, low-precision KV caches, and Model Runner V2 — The Oct 18 release packs 814 commits: a default POST /v1/systemone endpoint, generic Hugging Face tool/reasoning parsers, NVFP4/FP8/ultraquant KV paths across NVIDIA and ROCm, MRV2 as the ROCm default, faster kernel preload/startup, plus security fixes that tighten CORS and chat-template abuse. Python 3.10 support is dropped. github.com · cmvga0sp0619b061342a54489

Envoy Proxy 1.40.0 marks HTTP/3 and QUIC stable and turns on post-quantum TLS by default — The Oct 13 major release stabilizes upstream/downstream HTTP/3, adds X25519MLKEM768 to default ECDH curves, introduces post-match route_specifiers, expands AI/MCP filters, and migrates the build from WORKSPACE to bzlmod. Downstream header forwarding for mcp_router is off by default. github.com · cmvga0sp262ee1227cee92686

llama.cpp v0.7.0 adds MoE expert GPU caching and LiliCorr speculative decoding — The Oct 15 versioned release brings --moe-cache-mib (up to ~2.2× decode when experts are host-offloaded), LiliCorr and GLM5-Next MTP drafting, EmbeddingGemma-2 and several decision models, a refactored chat-session API, and a new default server port of 9931 (was 8080). github.com · cmvga0sp5ac7be9e3df9a794b

FreeRTOS Kernel V11.3.2 patches Cortex-R82 MPU region checks — Released Oct 16, the kernel fixes inverted PRLAR address masks that could let unprivileged tasks on MPU-enabled Arm Cortex-R82 builds reach privileged memory, plus TF-M 2.3.0 wrappers, 64-bit buffer-length typing, and IAR TrustZone build breakages. github.com · cmvga0sp7a802aa1d4986f14f

Cilium 1.20.3 hardens eBPF datapath GC, DNS policies, and Gateway API — The Oct 15 stable patch prevents conntrack GC from deleting live NAT mappings, stops L7 DNS policies from lingering across agent restarts, fixes Envoy ADS listener address updates, and tightens Gateway API ExternalAuth and BackendTLSPolicy behavior across the 1.20 line. github.com · cmvga0sp9825687daea8fed71

Apache promotes Auron, Reqsign, and ResilientDB to Top-Level Projects — On Oct 14 the ASF graduated vectorized query accelerator Auron and BFT ledger ResilientDB from the Incubator, and elevated Rust cloud request-signer Reqsign (used by OpenDAL, uv, and Lance) from an OpenDAL subproject to a standalone TLP for multi-cloud SigV4-style auth without heavy SDKs. globenewswire.com · cmvga0spb34e5f5038ee3a930

Traefik 3.7.15 closes three CVEs and rejects CONNECT early — The Oct 15 patch release fixes GHSA-p8wx-ph99-xgcr, GHSA-ww7c-q3mv-xx22, and GHSA-28hp-c82p-8vqj, rejects CONNECT before the muxer regardless of HTTP version, and includes Gateway API / ingress-nginx routing and auth-TLS fixes. github.com · cmvga0spdf7978e7b72240254